Repository navigation
ci(release): never release the template itself, guard the trigger - #145
Conversation
- the template repository is excluded from releasing; derived repositories are unaffected (the literal stays unchanged there) - base filter branches: [main], dispatch confined to main - drop PAGES_DEPLOY_TOKEN: reusable-maven-release v0.30.0 does not declare it, so every run ended in startup_failure - header explains that merging a current-version change IS a release Must merge on its own, before any change of release.current-version. Co-Authored-By: plan-marshall <noreply@cuioss.de>
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Warning Review limit reachedNext included review available in 40 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository: cuioss/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: cuioss/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe release workflow now filters pull-request runs by target branch and changed path. Job conditions restrict eligible repositories and runs. The reusable workflow no longer receives ChangesRelease workflow
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~8 minutes Merge Risk: ⚪ Minimal · up to The release safeguards have no identified merge-blocking issue; normal CI checks remain pending. 🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. This changes the policy that authorizes Maven Central publication, including which repositories, branches, and pull-request events may trigger a release. If the guard is wrong, an unintended merge or manual dispatch could publish artifacts that cannot simply be withdrawn by reverting the workflow; the release decision is active for every matching event from the moment it ships.
Co-Authored-By: plan-marshall <noreply@cuioss.de>
**Stacked on #145. Merge #145 first**, then retarget this PR to `main`. This PR changes `release.current-version`; without #145's template-repository exclusion, merging it would publish `cui-java-module-template` 0.1.0 to Maven Central. ## Summary Lessons from bootstrapping `plan-marshall-mcp` from this template: **Release safeguards** - `release.current-version` `1.0.0` → `0.1.0` (pom `0.1.0-SNAPSHOT`, next `0.1.1-SNAPSHOT`), with a warning comment. A derived repository never has to touch the value. `plan-marshall-mcp` changed it while customizing, which published its 0.1.0 by accident. The first release is now a deliberate dispatch. - New `.claude/skills/release/SKILL.md`, a generic runbook derived from API-Sheriff and plan-marshall-mcp. It covers: - the two release paths - the checks before the cut: trigger, tag, Central, green `main`, quiesced queue - the exactly-one verification after it - the release-notes format - Release rules added to `CLAUDE.md` and to a new README section, *Releasing*. **`customize.sh` fixes** (verified on a scratch copy with custom values; the result builds with `./mvnw verify`) - The `project.yml` keys `pages-reference:` and `sonar-project-key:` never matched the file (`reference:` / `project-key:`). Fixed; the `description` is now set too. - The script replaced `<n>`, which the POM doesn't have, so `<name>` was never set. - Renaming the module also rewrote `exports` to the module name. The package stays `de.cuioss.template`, so the result didn't compile. The script now keeps it. - Removed the step for `SECURITY.md`, which doesn't exist here. - `CLAUDE.md` and the runbook get the repository slug. - The script never touches `release.yml` (template exclusion) or `current-version`. - It ends with the next steps. **Org and setup** - README: an *After creating the repository* checklist: - add the repository to `consumers:` in cuioss-organization - apply `repo-settings` and `branch-protection` - SonarCloud: rename `master` → `main` before the first analysis, and expect a quality gate of `NONE` once - Corrected the secrets note: the callers pass secrets explicitly and must pass only declared ones. - `maven.yml` also builds `release/*` pushes, like the org example. - `.gitignore`: plan-marshall `.plan/` block, `.factorypath`. - `dependabot.yml`: adds a github-actions lane for third-party actions. The org workflow pins stay with the cuioss-release-bot; Dependabot doesn't bump them, so the two don't compete. The baseline stays at Java 21. ## Test plan - [x] `customize.sh` on a scratch copy: all keys replaced; `current-version` and the `release.yml` literal untouched; `./mvnw verify` green - [ ] CI green --------- Co-authored-by: Oliver Wolff <23139298+cuioss@users.noreply.github.com> Co-authored-by: plan-marshall <noreply@cuioss.de>
1 participant
Summary
Release safeguards based on the accidental
plan-marshall-mcp0.1.0 publication. That repository was created from this template. Its bootstrap PR changedrelease.current-versionfrom1.0.0, the value it inherited from this template, to0.1.0, and the central guard correctly read that as a version bump.if:now excludescuioss/cui-java-module-template. Repositories created from the template are unaffected, andcustomize.shmust not rewrite this file.branches: [main]base filtermainmerged == truecheckPAGES_DEPLOY_TOKENremoved.reusable-maven-release.ymlv0.30.0 does not declare that secret, so every release run so far ended instartup_failure. The fix makes the workflow runnable, which is why the repository exclusion ships in the same PR.Merge order: this PR must merge on its own and first. A follow-up PR changes
release.current-version(1.0.0→0.1.0, so that derived repositories never need to touch it). With this guard in place, that merge cannot publish the template.Test plan
if:expression is as intendedSummary by CodeRabbit